SCENARIO 1: You have just completed a routine security audit on the companys information systems, and you found several areas of vulnerability. For example, file permissions have not been updated in some time, no comprehensive password policy exists, and network traffic is not fully encrypted. You noted these areas, among others, in a report to your supervisor. The report included specific recommendations to fix the problems. Your supervisor responded by saying that budgets are tight right now, and she could not approve your requests to resolve these issues. As an IT professional, you are very uncomfortable with the risk level, but you have been unable to sway your supervisor. When you discussed the situation with a colleague, he said, Why worry about it? If its good enough for her, it should be good enough for you.

What do you think of your colleagues advice, and why? Is this an ethical question? If you are still is uncomfortable, what are your options?

SCENARIO 2: You work for a large IT company. The company is presented with a legal directive from the federal government to divulge personal data regarding some of the companys customers who are suspected of wrongdoing. You feel that this is a violation of the customers privacy and you are reluctant to comply with the request. Your boss tells you the company has no choice; it must follow the law. You are told you can always resign from the company if you feel so strongly about the situation.

Instead of complying or resigning, you go public. You use the media to advocate your point of view for freedom and privacy, even while knowing that your actions will have far-reaching consequences. Instead of just losing your job, you risk losing your freedom and your future.

Did you do the right thing? Are you a hero of free speech or a criminal (and possibly even a traitor)? What other options were available to you? What should the company have done when you went public? What should the government do?